Quantum broadcast communication 
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Broadcast encryption allows the sender to securely distribute his/her secret to a dynamically 
changing group of users over a broadcast channel. In this paper, we just consider a simple broadcast 
communication task in quantum scenario, which the central party broadcasts his secret to multi- 
receiver via quantum channel. We present three quantum broadcast communication schemes. The 
first scheme utilizes entanglement swapping and Greenberger-Horne-Zeilinger state to realize a task 
that the central party broadcasts the secret to a group of receivers who share a group key with 
him. In the second scheme, based on dense coding, the central party broadcasts the secret to 
multi-receiver who share each of their authentication key with him. The third scheme is a quantum 
broadcast communication scheme with quantum encryption, which the central party can broadcast 
the secret to any subset of the legal receivers. 

PACS numbers: 03.67.Dd, 03.67.Hk 




I. INTRODUCTION 



Quantum cryptography has been one of the most re- 
markable applications of quantum mechanics in quantum 
information science. Quantum key distribution (QKD), 
which provides a way of exchanging a private key with 
unconditional security, has progressed rapidly since the 
first QKD protocol was proposed by Benneett and Bras- 
sard in 1984 Ij . A good many of other quantum commu- 
nication schemes have also been proposed and pursued, 
such as quantum secret sharing (QSS) 2, 3, |j, 
quantum secure direct communication (QS DC) 
111 111 in El in El [Hill in m in. QSS is the 
generalization of classical secret sharing to quantum sce- 
nario and can share both classical and quantum messages 
among sharers. Many researches have been carried out 
in both theoretical and experimental aspects after the 
pioneering QSS scheme proposed by Hillcry, Buzek and 
Bcrthiaume in 1999 0. Different from QKD, QSDC's 
object is to transmit the secret message directly without 
first establishing a key to encrypt it. QSDC can be used 
in some special environments which has been shown in 
Ref. 1^ Ji)]. The works on QSDC have attracted a great 
deal of attention. Bostrom and Felbinger |3] proposed a 
Ping-Pong protocol which is quasi-secure for secure direct 
communication if perfect quantum channel is used. Deng 
et al. [i3,El| put forward a two-step QSDC protocol us- 
ing Einstein-Podolsky-Rosen (EPR) pairs and a QSDC 
scheme by using batches of single photons which serves 
as quantum one-time pad cryptosystem. We proposed a 
multiparty controlled QSDC scheme using Greenberger- 
Horne-Zcilingcr (GHZ) state and a QSDC scheme based 
on the order rearrangement of single photons ES ES- 
Lee et al. [2l| presented two QSDC protocols with user 
authentication. Recently, some multiparty quantum di- 
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rect communication schemes which are used to realize 
the task that many users send each of their secrets to a 
central party have been proposed. Gao et al. [23 pro- 
posed a QSDC scheme using GHZ states and entangle- 
ment swapping. In their scheme, the secret messages can 
be transmitted from two senders to a remote receiver. 
They also presented a simultaneous QSDC scheme be- 
tween the central party and other M parties using GHZ 
states, which the M parties can transmit each of their 
secret me ssag es to the central party simultaneously '24] . 
Jin et al. [25| put forward a simultaneous QSDC scheme 
by using GHZ states and dense coding. 

Broadcast encryption involves a sender and multi-user 
(receiver) 26] . The sender first encrypts his content and 
then transmits it to a dynamically changing set of users 
via insecure broadcasting channels. The broadcast en- 
cryption scheme assures that only privileged receivers 
can recover the content subscribed and the unauthorized 
users cannot learn anything. In this paper, we consider 
a simple broadcast encryption task in quantum scenario, 
called quantum broadcast communication (QBC), which 
the central party broadcasts his secret message to a group 
of legal receivers via quantum channel and any illegal re- 
ceiver cannot obtain the central party's secret. We then 
consider a naive scheme that the sender first establishes a 
common key with multi-user and then encrypts the secret 
with the sharing key. Thus the multi-user can obtain the 
sender's secret by decrypting the cypher with the key. In 
the present schemes, we try to allow the sender broadcast 
the secret to multi-user directly without first establishing 
a common key to encrypt it. We then present three QBC 
schemes based on the ideas in Ref. 0, 0, IH ^^. In 
scheme 1, a group of users share a group key with the 
central party. After authenticating the users, the central 
party broadcasts his secret message to them by using en- 
tanglement swapping z?|. In scheme 2, each user shares 
a authentication key with the central party. The central 
party first authenticates the users and then broadcasts 
the secret to them by using dense coding [23 . In scheme 



3, based on quantum encryption [27|, the central party 
utilizes controUed-not (CNOT) operation to encrypt his 
secret qubit by using the particle in GHZ state and the 
designated users also use CNOT operation to decrypt the 
central party's secret. 

The aim of QBC is to broadcast the secret to legal 
multi-user directly. In our schemes, we suppose a trusted 
third party, Trent, broadcasts his secret to r legal users, 
Alicei, Alice2, •••, Alice^. Similar to Ref. 21], Trent 
shares a secret identity number IDi (i = 1, 2, • • • , r) and 
a secret hash function hi (i = 1, 2, • • • , r) with each user. 
Only the users' identities are legal can Trent broadcast 
his secret to them. Here the hash function is 



/i:{0,l}'x{0,ir^{0,ir. 



(1) 



where I, m and n denote the length of the identity num- 
ber, the length of a counter and the length of authenti- 
cation key, respectively. Thus the user's authentication 
key can be expressed as AK = h(ID, C), where C is the 
counter of calls on the user's hash function. When the 
length of the authentication key is not enough to satisfy 
the requirement of cryptographic task. The parties can 
increase the counter and then generates a new authenti- 
cation key. We denote the authentication keys of Alicei , 
Alice2, ■ • • , Alice^ as AKa^ = Ha^ {IDa^ , C^J, AKa2 = 
hA, {I Da, , Ca J , • • • , AKa^ = hA^ {IDa^ , Ca J . 

We then give some relations which will be used in our 
schemes. The four Bell states and the eight three-particle 
GHZ states are defined as 



10+) 
IV'+> 



n/2 
1 

71 



(|oo) + |ii)),ir 

(|01) + |10)),|^- 



1 

1 

71 



(|00> 
(101) 



111)), 

|10)), (2) 



and 

l*i) 



-i=(|000) + |111)), \^'2) = ^(1000) - |111)), 



IVI/3) = ^(|100) + 1011)), IVI/4) = ^(|100) - 1011)), 
IVI/5) - ^(1010) + |ioi)), 1*6) = ^(1010) - |ioi)), 

1*7) = ^(|110) + 1001)), Ivl/s) = ^(|110) - 1001)), 

(3) 

respectively. The four unitary operations which can be 
encoded as two bits classical information are 



/ 



|0)(1| 



|1)(1|, 
|1)(0|, 



*a,-|0)(l|-|l)(0|, 
a. = |0)(0|-|l)(l|. 

Here the encoding is defined as / -^ 00, ax — > 01, iffy 
10, (Jz -^ 11- The Hadamard {H) operation is 



(4) 
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|0)(1| + |1)(0|). 



(5) 



II. SCHEMEl: QUANTUM BROADCAST 

COMMUNICATION USING ENTANGLEMENT 

SWAPPING 



In scheme 1, Trent utilizes multi-particle GHZ states 
and entanglement swapping to realize quantum broad- 
cast communication, called QBC-ES. We first present our 
QBC-ES scheme with two users (Alicei, Alice2) and then 
generalize it to the case with many users (Alicei , Alice2 , 
• • • , Alice^). In the scheme, Trent broadcasts his secret 
message to a group of users and all users have the same 
authentication key which we call group key (GK). 

(51) Trent prepares an ordered N three-particle GHZ 
states each of which is in the state |*i) = -^(|000) + 

|111))tAiA2j where the subscripts T, Ai and A2 repre- 
sent the three particles of each GHZ state. Trent takes 
particle T {Ai, A2) for each state to form an ordered 
particle sequence, called T {Ai, A2) sequence. For each 
GHZ state, Trent performs I or H operation on particles 
Ai and A2 according to the group key, GK. If the ith 
value of GK is (I), he performs / {H) operation on 
particles Ai and A2. As we have described in Sec. Q] 
here GK = h{ID,C). If the length of GK is not long 
enough to N, new GK can be generated by increasing 
the counter until the length of GK is no less than N. 
Trent also performs randomly one of the two operations 
{/, i(7y} on particle Ai. He then sends Ai and A2 se- 
quences to Alicei and Alice2, respectively. 

(52) After receiving Ai and A2 sequences, Alicei and 
Alice2 perform corresponding / or H operations on each 
of their particles according to GK. For example, if the 
ith value of GK is (1), Ahcei executes / {H) opera- 
tion on particle Ai. They inform Trent that they have 
transformed their qubit using unitary operation accord- 
ing to GK. Trent then authenticates the users and checks 
eavesdropping during the transmission of Ai and A2 se- 
quences. 

(53) The procedure of authentication and eavesdrop- 
ping check is as follows, (a) After hearing from the 
users, Trent selects randomly a sufficiently large subset 
from the ordered N GHZ states, (b) He measures the 
sampling particles in T sequence, in a random measur- 
ing basis, Z-basis(|0),|l)) or A-basis {\+)=^{\0) + |1)), 

| — )=4=(|0) — |1))). (c) Trent announces pubhcly the po- 
sitions of the sampling particles and the measuring basis 
for each of the sampling particles. Alicei (Alice2) mea- 
sures the sampling particles in Ai {A2) sequence, in the 
same measuring basis as Trent. After measurements, the 
users publishes their measurement results, (d) Trent can 
then authenticate the users and check the existence of 
eavesdropper by comparing their measurement results. 
If the users are legal and the channel is safe, their results 
must be completely correlated. Suppose Trent's opera- 
tion performed on particle Ai is /. When Trent performs 
Z-basis measurement on his particle, Alices' result should 
be |00) (111)) if Trent's resuh is |0) (|1)). On the con- 
trary, Alices' result should be | -I- -I-) or | ) (| H — ) 



or I — h)) if Trent performs X-basis measurement on his 
particle and gets the result |+) (|— )). Thus if Trent con- 
firms that the users are legal and there is no eavesdrop- 
ping, they continue to execute the next step. Otherwise, 
he aborts the communication. 

(54) After authenticating the users, Trent announces 
publicly his random operations on the particles in Ai 
sequence and Alicei performs the same operations on 
them. Trent divides the remaining GHZ states into M 
ordered groups, {P(l)rAi^2, Q{1)t'A{A'^}, {P(2)tAiA2, 
QmT'A[A'J, •••, {P{M)ta,a,, Q{M)t'a[A',}, where 1, 
2, • • • , M represent the order of the group and the sub- 
scripts T and T' {Ai, A[ and A2, A!^) denote Trent's 
(Alicei 's and Alice2's ) particles. Trent encodes his se- 
cret on each particle T by using one of the four operations 
{/, a,j,^ icTy, cr^}- The parties agree that the four opera- 
tions represent two-bit classical message, as we have de- 
scribed in SecQI Alicei generates a M-bit random string, 
ai. For each group, she performs one of the two unitary 
operations {/, ax} on particle Ai according to ai. For 
example, if the ith value of oi is (1), Alicei executes 
/ (ax) operation on particle Ai. Here Alicei does not 
perform any operation on particle A'^. 

(55) Ahcei (Alicc2) measures particles Ai and A[ {A2 
and A2) of each group in Bell basis. After measurements, 
Alicei publishes her measurement results, but Alice2 does 
not do this directly. According to GK, Alice2 transforms 
her result by using corresponding unitary operation. If 
the {2i - l)th and 2ith values of GK are 00 (01, 10, 11), 
she performs / (ax, iay, az) operation on her result and 
then publishes the transformed result. If Alice2's result 
is |(/)+) and the corresponding bits of GK are 01, the 
published result by her is IV"^)- 

(56) Trent performs Bell basis measurement on parti- 
cles T and T' of each group and publishes his measure- 
ment results. According to the published information, 
the users can obtain Trent's secret message. We then 
explain it in detail. The state of a group can be written 
as 



1*1; 



TA1A2 



+ \<t'TT')\4'MA')\'l'MA'^) 
+ \^TT')\<t>XAO\'t>MAO + \<t>TT')\^MA')\'I^XAO 

+ \^TT')\^tA')\^-MA') + \^TT')\^MAO\<A!)m 



If Trent's encoding operation is ax which corresponds to 
secret bits 01 and Alicei 's random operation is also ax 
corresponding to bit 1, |^i)tAiA2 is then transformed to 



|*7)tAiA2 and the state of the group becomes 

-\i'TT')\y^A^A[)\'l'MA',) 
-|V'TT')l<Ai)l<^iAi) + \^TT')\^MAi)\'l'tA'J 
+ l4T'>l<^XAi>I^XAi> - I^TT'Mma'Mma'J 
-\^TT')\^tA',MA..A'J + \^TT')\rA,A'J\<A'J)-i7) 

From the results of Trent and Alicei , Alice2 can deduce 
Trent's secret message because the three parties' results 
correspond to an exclusive state. For example, the re- 
sults of Trent and Alice 1 are each IV'^t') ^^"^ \''I^a a' ) ^'^^ 
Alice2's original result is 10^ ^, ). According to Eq. iQ, 

the state of the group must be |^E'7)tAiA2®I^i)t'A' A' ■ 
Alice2 then knows Trent's secret must be "01" because 
only the operation cr^, (g) cr^, applied on particles T and Ai 
can change the state |^i) into 1^7). On the other hand, 
Alicei knows GK and she can deduce Alice2's original 
result according to her published result. Similarly, she 
can also obtain Trent's secret. Thus Trent broadcasts 
his secret to two legal users. 

Now, let us discuss the security for the present scheme. 
The security requirement for the scheme is that any il- 
legal user cannot obtain Trent's secret. As long as the 
procedure of authentication and eavesdropping check is 
secure, the whole scheme is secure. Anyone who has no 
GK cannot obtain Trent's secret message because it is 
impossible to deduce a definite result about the secret 
from the published results. We then discuss the security 
for the procedure of authentication and eavesdropping 
check. 

At step (SI), Trent performs I or H operation on par- 
ticles Ai and A2 according to GK which is only shared 
by the three parties. If the «th bit of GK is or 1, the 
three-particle GHZ state becomes 
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or 



1^.) - ^(|o- 



-))=-^(|+)|,^+)+|-)|V.+)) 



- 2 [l+>(l + +> + I - -)) + |-)(l + +) - I - -))]-(9) 

According to Eqs. (O and ©, if an eavesdropper. Eve, 
intercepts particles Ai and A2 and makes a Bell basis 
measurement on them, she can obtain partial information 
of GK . However, Trent performs random I or iay oper- 
ation on particle Ai, which can prevent Eve from eaves- 
dropping the information of GK . As a result of Trent's 



operation, there are four possible states |<&i), |'I'2), 

|$3) = -^(-1010) + 1101)) = -^(|+)|V'-)-h)|V+)) 



1, 



(10) 



and 



l$4) = -i=(|o-+)-|i + -)) = i=(i+)iv.-) + i-)ir)) 

= ^[|+)(l -+)-! + -» + |->(l + -) + !-+))]• 

(11) 

According to Eqs. (j5|)- (|ll|l . Eve cannot distinguish the 
four states by using Bell basis measurement. During the 
authentication and eavesdropping check, Trent measures 
his sampling particles in Z-basis or X-basis randomly 
and allows the users to measure their corresponding par- 
ticles in the same measuring basis. Suppose Trent per- 
forms Z-basis measurement on his particle and Eve also 
measures particles Ai and A2 in Z-basis. Eve publishes 
her measurement result after measurements. If the state 
is |$i) or 1^3) , Eve will not introduce any error during 
the process of authentication and eavesdropping check. 
However, If the state is [$2) and |<&4), Eve will obtain 
|00), |01), |10) and |11) each with probability 1/4 and 
the error rate introduced by her achieves 75%. Similarly, 
when Trent performs X-basis measurement and Eve mea- 
sures particles Ai and A2 in the same measuring basis, if 
the state is [$2) or |<1>4), Eve will not introduce any error. 
But if the state is |$i) and l^a). Eve will obtains | + -I-), 

I -I — ), I — h) and I ) each with probability 1/4 and 

the error rate is 50%. Suppose Trent performs X-basis 
measurement and Eve measures particles Ai and A2 in 
Bell basis. When Eve's result is \4>'^) (1-0")), her action 
will not be detected by Trent if she publishes the result 

I -|- -|-) or I ) (I -I — ) or I — h)). However, when her 

result is |0") (|V'+)), if the state is |$4) (l^a)), Trent will 
detect Eve's eavesdropping. Similarly, if Trent performs 
Z-basis measurement and Eve executes Bell basis mea- 
surement. Eve's eavesdropping will also be detected by 
Trent with a certain probability. 

According to Stinespring dilation theorem, Eve's ac- 
tion can be realized by a unitary operation E on a, large 
Hilbert space, HaiA2 ® He- Then the state of Trent, 
Alicci, Alicci and Eve is 

l*>= E \eT,AuA,)\T)\A,A2), (12) 

T,Ai,A2G{0.1} 

where \e) denotes Eve's probe state and \T) and [^1^2) 
are states shared by Trent and the users. The condition 
on the states of Eve's probe is 

E (£t,Ai,aJ eT,Ai,A2) = 1- (13) 

T,Ai,A2<£{0,l} 



As Eve can eavesdrop particle Ai and A2, Eve's action 
on the system can be written as 

1$) = -^[|0)(ai|00)|eooo)+/3i|01)|£ooi)+7i|10)koio) 

+ <5i|ll)|£oii)) + |l)(<52|ll)|£ioo)+72|10)|£ioi) 
+ /32|01)|eiio)+a2|00)|eiii)]. (14) 

When the state is \^i), the error rate introduced by Eve 
is e = 1 — |q;iP = 1 — |<^2p- Here the complex numbers 
a, /3, 7 and 6 must satisfy EE^ = I. 

We then generalize the three-party QBC-ES scheme 
to a multiparty one (more than three parties). Suppose 
Trent wants to broadcast his secret to a group of users, 
{Alicci, Alice2, • • • , Alices}. He prepares an ordered N 
(r -t- l)-particle GHZ states 
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V2 
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T,Ai, 



(15) 



The details of the multiparty QBC-ES is very similar 
to those of three-party one. Trent performs I or H 
operations on particles Ai, A2, •••, Ar according to 
GK they shares. He also performs randomly / or iay 



operation on particles Ai, A2, •••, A 



(r-l) 



and sends 



Ai, A2, • • • , Ar sequences to each Alicei , Alice2 , • • • , 
Alice^. After receiving the particles, each user performs 
I or H operations on their particles according to GK . 
Similar to step (S3), Trent authenticates the users and 
checks eavesdropping. If all users are legal, he announces 
publicly his operations on particles Ai, A2, • • • , A(r-i) 
and Alicei, Alice2, • • • , Alice(r_i) execute the same op- 
erations on them. Trent divides all GHZ states into 
N ordered groups, [{P(1)tAi-a,, Clil)T'A[---A'J, ■■■, 
{P(N)TAi---Ari Q(^)t'A' —A'}]- He encodes his secret 
on particles T using one of the four operations, {/, 
ax, i(Jy, Oz}- Alicei, Alice2, •••, Alice(r_i) each per- 
form randomly one of the two operations {/, Ux} on 
their particles. Each user measures particles Ai and 
A'j (i = 1, 2, • • • , r) in Bell basis. After measurements, 
Alicci, Alice2, • • • , Alice(,._i) publish their measurement 
results. Alice,- first transforms her result according to 
GK and then publishes the transformed result. Trent 
also performs Bell basis measurement on particles T and 
T' of each group. Thus Trent broadcasts his secret to all 
legal users, Alicei, Alice2, • • • , Alice (T — 1) and Alice^. 
The security for multiparty QBC-ES scheme is similar 
to that for three-party one. As long as the procedure 
of authentication and eavesdropping check is secure, the 
scheme is secure. 

Based on entanglement swapping, we can also ob- 
tain a multiparty simultaneous quantum authentication 
scheme using multi-particle GHZ state. Here each user 
shares each of their authentication keys with Trent. 
Trent prepares a batch of GHZ states -^(|00---0) + 

|11 • • • l))t.i,2.-- .r- For each GHZ state, he sends particles 
1, 2, 3, • • • , r to Alicei, Alice2, • • • , Alice^, respectively 
and keeps particle t. Similar to the above method, he 



divides all GHZ states into ordered groups and performs 
randomly one of the two unitary operations { /, iay} on 
particle t. Each Alice^ (i = 1, 2, • • • , r) performs / or iay 
operation on their particles according to their authen- 
tication keys. Similarly, the parties perform Bell basis 
measurements on their particles of each group. Trent 
lets the users publish their measurement results and can 
then authenticate the r users simultaneously. 



Suppose Trent performs Z^-basis measurement on parti- 
cle T. If Trent's result is |0) (|1)), the users' results must 
be |00) (|11)). If Trent performs X-basis measurement 
on his particle and gets the result |+) (|— )), the users' 

results should be | -I- -I-) or | ) (| + -) or | - +)). If 

any user is illegal, Trent abandons the communication. 
Otherwise, they continue to the next step. 



III. SCHEME2: QUANTUM BROADCAST 
COMMUNICATION BASED ON DENSE CODING 

In the scheme 1, Trent can only broadcast secret to a 
group of users who share a GK with him. Based on dense 
coding, we present a quantum broadcast communication 
scheme, called QBC-DC scheme, which Trent broadcasts 
his secret to multi-user {Alicei, Alice2, • • • , AlicCr} and 
the users shares each of their authentication keys with 
Trent. We first present a three-party QBC-DC scheme 
and then generate it to a multiparty one. 

(51) Trent prepares an ordered N three-particle 
GHZ states randomly in one of the eight GHZ states 
{\'^i)tAiA2,\'^2}tAiA2,- ■ ■ ,\'^7)tAiA2}, where the sub- 
scripts T, Ai and A2 represent three particles of each 
GHZ state. He takes particle T from each of the GHZ 
states to form an ordered particle sequence, called T se- 
quence. Similarly, the remaining partner particles com- 
pose Ai sequence and A2 sequence. Trent performs one 
of the two operations {/, H} on each particle in Ai se- 
quence according to Alicei 's authentication key, AKai- 
Here AKai — hAi{IDAi,CAi)- That is, if the zth value 
oi AKai is (1), he performs / (H) operation on particle 
Ai . Trent also executes I or H operation on particle A2 
according to Alice2's authentication key, AKa2- After 
doing these, he sends Ai and A2 sequences to Alicei and 
Alice2, respectively. 

(52) Alicei (Alice2) performs corresponding I or H 
operation on each of her particles according to AKai 
{AKa2)- For example, if the ith value of AKai is (1), 
/ {H) operation is applied to particle Ai. After doing 
these, they inform Trent. Trent then authenticates the 
users and checks eavesdropping during the transmission 
of Ai and A2 sequences. 

(53) We then describe the procedure of authentication 
and eavesdropping check in detail, (a) Trent selects ran- 
domly a sufhciently large subset from the ordered GHZ 
states, (b) He measures the sampling particles in T se- 
quence in Z-basis or X-basis randomly, (c) Trent an- 
nounces publicly the positions of the sampling particles 
and the measuring basis for each of the sampling photons. 
Alicei and Alice2 measure their sampling particles in the 
same basis as Trent. After measurements, the users pub- 
lishes their measurement results, (d) Trent can authen- 
ticate the users and check the existence of eavesdropper 
by comparing their measurement results. If the users are 
legal and the channel is safe, their results must be com- 
pletely correlated. For example, the initial state is |^i). 



(S4) Alicei and Alice2 each generate a random string, 
fli and 02. According to their random strings, they per- 
form one of the two unitary operations {/, i(Jy} on par- 
ticles Ai and A2, respectively. For example, if the zth 
value of Alicei 's random string is (1), she performs / 
{i<Jy) operation on particle Ai. After their operations, 
they return Ai and A2 sequences to Trent. 



(S5) Trent selects randomly a sufficiently large subset 
from the ordered GHZ states and performs randomly one 
of the four unitary operations { I, ax, iay, az} on each of 
the sampling particles in T sequence. He then encodes his 
secret message on the remaining particles T by perform- 
ing one of the four unitary operations on each of them. 
Trent measures particles T, A\ and A2 of each GHZ state 
in three-particle GHZ basis. He announces publicly the 
positions of the sampling particles and lets each user pub- 
lish their corresponding random operations on the sam- 
pling particles in ^1 and A2 sequences. According to his 
measurement result, Trent can check the security for the 
transmission of the returned particle sequences. When 
the initial state is |^i), his result is j^g) and his op- 
eration on particle T is da;, he can deduce Alicei 's and 
Alice2's operations are each iay and /. He then compares 
his conclusion with the operations published by the users 
and can decide the security for the transmitting parti- 
cles. If he confirms that there is no eavesdropping, he 
publishes his measurement results and the initial GHZ 
states he prepared. Alicei and Alice2 can then obtain 
Trent's secret. For example, when the initial state is 
1^1) and Trent's operation is ax (corresponds to his se- 
cret 01), |\E'i) is transformed to jvl/s), if Alicei and Alice2 
perform iay and / operations on particles A\ and A2, 
respectively. That is, ax®i<yy®i\^\) = \^%)- According 
to her operation performed on particle A\ (^2)) Trent's 
result l^g) and the initial state \^\), Alicei (Alice2) can 
obtains Trent's secret message, 01. 



The security for the three-party QBC-DC scheme is 
based on that for the procedure of authentication and 
eavesdropping check. Trent prepares an ordered N GHZ 
states each of which is in one of the eight GHZ states 
and performs I or H operation on particle Ai and A2 
according to each user's authentication key. For each 
initial state, there are four possible states after Trent's 
operations. For example, the initial state is |^i), then 



the four possible states are 
|0i) = i=(|000) + |lll)), 
1^2) = -i=(|0 + 0) + |l-l)), 

= ^[|+)(ir> + iV'+» + i-)(i'^+)-iv^-))] 

\n,) = -L(|oo+) + 111-)), 

1^4) = -i=(|0 + +) + |l--)). (16) 

Eve has no information of the user's authentication key. 
If Eve intercepts particles Ai and A2 and performs Bell 
basis measurement on them, she cannot obtain the infor- 
mation of the user's authentication key because she can- 
not distinguish the four states. During the procedure of 
authentication and eavesdropping check, Trent performs 
randomly Z-basis or X-basis measurement on his parti- 
cle. When Trent performs Z-basis measurement and Eve 
measures the intercepted particles in the same measuring 
basis as Trent, if the state is not |rii), it is possible for 
her to publish a wrong result after measurements. Simi- 
larly, whether Eve utilizes .Z-basis, X-basis or Bell basis 
measurement, she will publish a wrong result with some 
probability and her action will be detected by Trent dur- 
ing the procedure of authentication and eavesdropping 
check. We can also describe Eve's effect on the system 
as Eq. (|14|) . If the initial state is l^s), the error rate 
introduced by Eve is e = 1 — |7ip. 

Wc then generalize the three-party QBC-DC scheme 
to a multiparty (more than three parties) one which 
Trent broadcasts his secret to r users {Alicei, Alice2, 
• • ■ , AlicBr}. He prepares an ordered N GHZ states each 
of which is randomly in one of the 2^^^^' (r + l)-particle 
GHZ states 



^-^ 



\ij---k) + \i3---k))T,Ai,-,A^ 



(17) 



where i, j,- ■ ■ ,k€ {0, 1} and i, j ,■ • • ,k are the counter- 
parts of i,j,--- , k. The details of the multiparty QBC- 
DC is very similar to those of three-party one. Trent per- 
forms I OT H operations on each particle in Ai { A2, • • • , 
Ar) sequence according to AKa^ [AKa^ , ■ ■ ■ , AKa^)- He 
then sends Ai, A2, • • • , A,, sequences to Alicei, Alice2, 

• • • , AlicCr , respectively. After receiving the particle se- 
quence, each user performs I or H operations on their 
particles according to their respective authentication key. 
Similar to step (S3) in the three-party QBC-DC scheme, 
Trent authenticates the users and checks eavesdropping. 
If any user is illegal, Trent aborts communication, oth- 
erwise, they continue to the next step. Alicei, Alice2, 

• • • , AlicCr perform randomly / or iay operation on their 
respective particles. After doing these, they return Ai, 



A2, ■ ■ ■ , Ar sequences to Trent. Trent first chooses a suf- 
ficiently large subset to check the security for the trans- 
mitting particles and performs randomly one of the four 
operations on the sampling particles in T sequence. He 
also encodes his secret on the remaining particles in T 
sequence using the four operations. Trent measures each 
of (r-f l)-particle GHZ states in (r-|- l)-particle GHZ ba- 
sis. He publishes the positions of the sampling particles 
and lets the users announce publicly their operations on 
the sampling particles. Trent can then check the security 
for the transmission of the returned particle sequences. 
If there is no eavesdropping, he publishes his measure- 
ment results and the initial (r -|- l)-particle GHZ states 
she prepared. Thus Trent broadcasts his secret to Alicei, 
Alice2, • • ■ , Ahce^. 



IV. SCHEME 3: QUANTUM BROADCAST 

COMMUNICATION BASED ON QUANTUM 

ENCRYPTION 



In scheme 2, Trent broadcasts his secret to a group 
of designated users. We then present a QBC scheme 
with quantum encryption, called QBC-QE scheme, which 
Trent can broadcast his secret to any subset of the users. 
The details of the QBC-QE scheme are as follows. 

(SI) Trent prepares an ordered N (r-|- l)-particle GHZ 
states each of which is in the state 



1 



V2 



(100- --O) 



111- 



■1» 



T,Al; 



(18) 



The N particles T form T sequence and the N particles 
Ai [i ~ 1,2,--- ,r) form Ai sequence. Trent performs 
one of the two operations {/, H} on the particles in Ai 
sequence according to Alices 's authentication key. That 
is, if AlicCi's AKAi is (1), Trent performs / {H) on 
particle Ai. Trent sends ^li, v42, ••■, A^ sequences to 
Alicei, Alice2, • • • , Alice^, respectively. 

(52) AlicCi (z = 1,2,--- ,r) performs corresponding 
I or H operation on each of her particles according to 
AKAi ■ Similar to the method of step (S3) in QBC-DC 
scheme, Trent authenticates the users and checks eaves- 
dropping by performing random Z-basis or A-basis mea- 
surement. If the users are legal and the channel is safe, 
they continue to the next step. Otherwise, Trent stops 
the communication. 

(53) Trent utilizes controUed-not (CNOT) operation 
to encrypt his secret message. For example, Trent trans- 
mits his secret P — {pi,p2, ■ ■ ■ ^Pm}, where pi G {0, 1} 
{i — 1,2, •• • ,m) represents classical bit or 1, to two 
users {AHcej, Alices} (l < j,k <r). He prepares his se- 
cret in the state \piPi)sjSkJ where Sj, Sk denote the two 
particles of the state. Trent performs CNOT operation 
on particles T, Sj and Sk (particle T is the controller and 
Sj and Sk are the targets). Then the GHZ state of the 



whole quantum system becomes 

W = ^(|oo...o,p.,p.) 

+ \11---1,1®P,,1®P,))t,Au-.a^,s,,s,- (19) 

According to AlicCj's and AlicCfc's authentication keys, 
Trent performs corresponding I or H operation on par- 
ticles Sj and Sk- For example, if the zth value of Alice^'s 
authentication key is (1), he performs / (iJ) operation 
on particle Sj. Here we denote the operation performed 
on S, (Sk) as i?^^^^ (H^k^^J, where AK^ iAK\J 

represents the ith value of Alice^'s (AlicCfe's) authentica- 
tion key and Hq (Hi) represents / {H) operation. Thus 
IT) is transformed to 



IT') 



1 






(20) 

Trent then sends Sj and Sk sequences to Aliccj and 
Aliccj: , respectively. To insure the security of the trans- 
mission of Sj and Sk sequences, Trent should insert ran- 
domly some sampling particles into Sj and Sk sequences 
before sending them to the users. The aim of inserting 
the sampling particles is to make the parties detect Eve's 
disturbance attack although Eve cannot obtain any in- 
formation of Trent's secret message. 

(S4) After receiving Sj {Sk) sequence, Alicej (Ahccfc) 
first performs corresponding I or H operation on the 
transmitting particles according to AKa (AKa^) and 
then executes CNOT operation on particles Aj {Ak ) and 
Sj {Sk)- For example, if the ith value of Ahce/s au- 
thentication key is 1, she performs H operation on the 
corresponding particle in Sj sequence and does CNOT 
operation on particles Aj and Sj {Aj is the controller 
and Sj is the target). According to Ea. lfT^ and ^U^, 
AlicCj and Alices can obtain Trent's secret message. 

In the above scheme, we just give an example of send- 
ing secret to any two users of r users. Obviously, Trent 
can send his secret to any subset of the legal users in the 
scheme. Strictly speaking, the present scheme is not a 
genuine QBC scheme because Trent must transmit a par- 
ticle sequence to each user. In view of Trent can transmit 
his secret to multi-user directly in this scheme, we still 
regard it as QBC. The security for authentication and 
eavesdropping check in the scheme is the same as that 



in QBC-DC scheme. After confirming the users are legal 
and insuring the security of the quantum channel, the 
GHZ states can be regarded as quantum key. Trent can 
then encrypt his secret message using quantum key they 
share. If Trent wants to transmit his secret to a subset 
of the users, he then performs I or H operation on the 
encoding particles according to each designated user's au- 
thentication key, which ensures that only the users in this 
subset can obtain Trent's secret. After insuring the se- 
curity for the transmitting particles, the designated user 
decrypts the secret by using quantum key. The proce- 
dure of encryption and decryption in our scheme is the 
same as quantum one-time pad, but the quantum key is 
the GHZ states shared by the parties. In the scheme, the 
quantum key can be used repeatedly for next round of 
cryptographic task. 



V. SUMMARY 

In summary, we have presented three schemes for quan- 
tum broadcast communication. In our schemes, Trent 
broadcasts his secret message to multi-user directly and 
only the legal users can obtain Trent's secret. In scheme 
1, based on the idea in Ref. ,241, we utilizes entanglement 
swapping to realize a QBC scheme which Trent sends his 
secret to a group of users who share a group key with 
Trent. In scheme 2, based on the idea in Ref. [23, we 
present a QBC scheme that Trent broadcasts his secret 
to multi-user who share each of their authentication keys 
with Trent, by using dense coding. Scheme 3 is based 
on quantum encryption [23, which Trent can broadcast 
his secret to any subset of the legal users. Because our 
schemes utilize block transmission, quantum memory is 
necessary. Moreover, compared with classical broadcast 
encryption which allows the sender to securely distribute 
the secret to a dynamically changing group of users, the 
present schemes are not genuine quantum broadcast en- 
cryption schemes. That is why we call them quantum 
broadcast communication schemes. We hope that our 
work will attract more attention and give impetus to fur- 
ther research on quantum broadcast communication. 
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